Security hardening checklist

Work through this checklist before a YTCC server controls a real plant, and again after every upgrade.

Before you begin

• You can sign in on the home page as root, the system administrator who manages the users of every project.
• You can sign in on the server with an administrator account, run the setup program and restart the YTCC service. Steps 4, 6 and 7 check settings files of the installation; they are work for the support of the installation.

Steps

1. Turn on user login in every project

With user login off, everyone who reaches the interface has every permission. Turn it on in every project. See Permission model.

2. Secure the default accounts

If user login was turned on in the configuration editor, YTCC created one user per default profile with the user name as password, for example operator / operator. Disable these users and create personal accounts for the people who use the project. See Permissions and default profiles. On a server upgraded from an earlier version, the root account starts with the password root; change it on the home page (session button, Change password). See Change the root password.

3. Use a strong PostgreSQL password

YTCC treats the PostgreSQL password as weak if it is empty, if it is a common default such as 1, 1234, postgres, admin or password, or if it is the same as the user name. A weak password produces a warning at every start.

1. Change the password of the postgres user in PostgreSQL, for example in pgAdmin: right-click the login role postgres, choose Properties… and enter the new password under Definition.
2. Run the setup program of the installed version again, choose Repair on the YTCC on this computer page, enter the new password on the Database page and click Test connection. Complete the repair. The setup program writes the password to a settings file that only administrators can read, and restarts the service. See Enter the database password.

With YTCC stopped, scada-manager db-password does the same in one command: it changes the password in PostgreSQL, checks it and updates the settings. See Database password.

Until the password is changed, YTCC writes a warning about the weak password at every start. Support can also make YTCC refuse to start with a weak password; see scada-manager commands.

4. Keep the message bus local

The message bus (NATS, port 4222) is for the processes of the server. By default it listens only on 127.0.0.1. Leave the nats_bind setting in manager.toml unset. If you set it to a network address, YTCC logs a security warning; allow port 4222 through the firewall only from the computers that run YTCC drivers.

5. Limit the services that listen on the network

These services accept connections on all network interfaces. Allow their ports through the Windows firewall only from the computers and devices that need them:

Port	Service	Can be bound to one interface
8770	Live data server	No (set to all interfaces)
162 (UDP)	SNMP trap receiver	Yes, with the trap bind address of the device
1883	MQTT broker driver	No
4840	OPC UA server driver	No
20000 / 19999	DNP3 driver in listening mode	Yes, with its bind address
47808 (UDP)	BACnet/IP driver	Yes, with its local IP address

The driver ports are open only while such a driver runs in a project. The web interface listens only on the server itself until config\ui-web.toml opens it; list the allowed networks there. See Port table and Open the interface from other computers.

6. Allow only known computers to the live data server (optional)

If you skip this step, every computer that reaches port 8770 can connect, as before. The live data server serves /api and the live updates (/ws) on this port; an [access] section in config\gateway.toml limits which client addresses it accepts there:

[access]
allow = ["10.0.0.0/24", "192.168.1.15"]
deny  = ["10.0.0.66"]

Rule	Meaning
No section, or both lists empty	Every client is accepted.
allow has entries	Only matching addresses are accepted.
deny	Refused even when allow matches them. With allow empty, everyone except these is accepted.
Loopback (127.0.0.0/8, ::1)	Always accepted: the YTCC processes on the server itself connect this way. A loopback entry in deny has no effect; the live data server logs a warning at start.
Entries	One address (192.168.1.15) or a network in CIDR notation (10.0.0.0/24), IPv4 or IPv6. An IPv4 address written as IPv6 (::ffff:10.0.0.5) counts as IPv4.
Invalid entry	The live data server does not start and names the entry. A network with host bits set, such as 10.0.0.5/24, is invalid too: write 10.0.0.0/24 or 10.0.0.5.

The check applies to the address of the TCP connection. A forwarded client address (X-Forwarded-For) is used only when the connection comes from a reverse proxy on the server itself. A refused client gets HTTP 403 with the code access_forbidden; the live data server logs a warning at most once a minute per address. Changes apply when the live data server is restarted: restart the YTCC service in Services.

Browsers that open the web interface reach the live data server through the interface, from the server itself, so this list does not apply to them. Limit them with allow in config\ui-web.toml; see Open the interface from other computers.

The list is a second layer behind the Windows firewall, not a replacement: keep the firewall rules of step 5. To control which devices may connect to the network, use port security or 802.1X on the switches.

7. Keep the development switches off

These switches exist for development and testing. All of them are off by default. Check that none of them is set on a site server:

Switch	Where	What it opens
YTCC_AUTO_LOGIN_USER	Environment of the project server	Sign-in without a password for a browser on the server. See Sessions.
YTCC_GATEWAY_AUTH=off	Environment of the live data server	Reading values, live updates and process control without sign-in
YTCC_WRITE_AUTH=off	Environment of the live data server	Commands without sign-in, recorded as anonymous; only together with YTCC_DEV=1
test_inject (or YTCC_TEST_INJECT)	Live data server configuration	Writing test values into signals through the API
ws_catch_all	Live data server configuration	Subscribing to all signals at once
allow_writes	OPC UA server driver	Accepting writes from OPC UA clients, without the YTCC command checks, permissions and command log

YTCC logs a warning or an error at start-up for each switch that is on.

8. Exclude YTCC from antivirus removal

If the antivirus program removes or blocks YTCC programs, add the folder that the Antivirus item of the setup program names, <installation folder>\target\release, for example C:\ytcc\v15\target\release, to its exclusions.